Assurance, reassurance and performance

We revisit some of the themes touched on in last year’s GGI COVID-100 bulletin about triangulated assurance, asking what boards should be thinking about as the country recovers from the pandemic.

Last summer, GGI published a bulletin about assurance – how information should be triangulated, the different levels of assurance and the impact of COVID-19 on assurance mechanisms.

Now the country is in what looks like the main recovery phase of the pandemic, it’s worth reflecting on last year’s bulletin – and in particular on what may change in the future.

Firstly, the elements of triangulation and levels of assurance continue to be sound and based on best practice around the country. Boards have had to become more reliant on what they hear from regulators and stakeholders to scrutinise and challenge the narrative presented at committee and board meetings without visiting or speaking with frontline staff as would have happened pre-COVID.

We would expect some form of return to in-person visits and meetings with frontline staff, albeit cautiously and prioritised. Prioritisation is likely due to concerns by regulators or intelligence showing that, despite corrective actions, there are still ongoing issues. It is important that there is not a rush to see frontline staff but equally there should be enough for boards to feel connected to what has changed post lockdown so non-executives in particular feel reconnected with the front line.

Regulators playing catch-up

Regulators and auditors have continued prioritised work throughout lockdown, both face-to-face and virtually. We would expect some form of normality to return but there will also be an expectation of a certain amount of ‘catching up’ from regulators, which we have already started to see. This will put pressure on assurance mechanisms that may have been reduced in their scope during lockdown.

It is therefore important that, as much as possible, organisations return to a fully functioning management assurance structure, partly as best practice but also in anticipation of regulatory oversight returning to normal levels. It may present a good opportunity for a review of management group structures to ensure they are aligned to strategic objectives and key areas of operational delivery.

More assurance is not necessarily good

But how much assurance is the right amount? More assurance is not necessarily a good thing. Providing reports can overburden staff, leaving less time to concentrate on actions to make the necessary improvements. Part of the answer is appropriate escalation – staff at the front line dealing with the day-to-day issues and the full detail in their areas. Any areas of concern should then be escalated through the organisation. Only the areas of greatest concern should be escalated to the executive; less concerning issues are dealt with lower down in the organisation. This ensures appropriate accountability.

Another key aspect is ensuring balance between assurance and reassurance. Assurance is based on information, evidence and triangulation. Reassurance is based on opinion, professional expertise and trust. Boards should not purely be getting assurance nor reassurance but a balance. This ensures that information has been analysed and turns data into intelligence. It means boards are not overrun with statistics but also that they are not just reliant on what the executive say is happening.

There’s more to assurance than metrics

We spoke in last year’s bulletin about triangulated assurance, but we didn’t specifically address the forms assurance can take in meetings.

Often, we see boards trying to combine their board assurance frameworks with key performance metrics and rate risks based on this. This shows a misunderstanding of the relationship between performance and assurance.

Performance metrics are just one form of assurance a board can receive. Action plans, strategy updates, service user feedback, and divisional deep dive presentations are all forms of assurance and all play a key part in understanding whether the controls for strategic risks are working. Key performance metrics therefore may be linked to providing assurance about a particular risk, but should not be solely relied upon.

Illuminations:

• It’s time to cautiously restart face-to-face board visits – but they should be prioritised to strategically and regulatory focused areas.
• Now is also the time to review and restart management assurance groups.
• Consider whether the reporting at board and committee balances assurance and reassurance.
• Is your BAF overly reliant on performance metrics to form an assurance opinion?

If you have any questions or comments about this briefing, please call us on 07732 681120 or email advice@good-governance.org.uk